You're viewing a single thread.
Brutal truth: You entered it wrong that many times.
Yes, really.
No, I know: It's crazy.
Did you have capslock on?
Edit: lol, I get the angry downvotes but I promise you this happens all the time
That or you just being obligated to change your password.
Yeah, this. There are sites for some maddening reason that don't bother to tell you it's time to change your password, they just force you to reset it without telling you why. Gotta be some kind of lazy shortcut to do it this way and not prompt the user that a password change is required.
Maybe it was just time, maybe your password got scrambled because your account was compromised: They'll never tell!
Maybe for some. Government sites that I use do this deliberately (not accept your current password) to make you change it. Pretty frustrating the first few times it happened, but now I know that when this happens it's because of a password change requirement. It's been years and they still haven't just made a "time to change" prompt.
It's pretty common in general but at least some of them actually do you the courtesy of letting you know.
It's frustrating but it does give information to attackers. If an attacker just sees the login attempt was rejected, then they have no idea if it was because the password changed, the user entered it wrong in the phishing form, the user realized it was a phishing attempt and gave garbage to fuck with them, the password expired, or if the service provider is on to them.
If an attacker sees "your password has been reset and you must set a new one" then they have some information that could be used to social engineer their way into the account. Especially if it's a work account where the email is behind the same password.
I've once had a user who managed to add a second keyboard layout by accident and switch to it on login. I found out when I reset his password and it still didn't work on the laptop of the users even if I typed it in myself.